temporary workaround for Pixel 3 camera UAF

PQ2A.190305.002.2019.03.05.03
Daniel Micay 2019-01-01 14:45:27 -05:00
parent c9df70d934
commit 8dc8aa12fa
1 changed files with 18 additions and 3 deletions

View File

@ -67,6 +67,7 @@ static union {
#ifdef USE_PKEY
int metadata_pkey;
#endif
bool zero_on_free;
};
char padding[PAGE_SIZE];
} ro __attribute__((aligned(PAGE_SIZE)));
@ -414,7 +415,7 @@ static void *slot_pointer(size_t size, void *slab, size_t slot) {
}
static void write_after_free_check(const char *p, size_t size) {
if (!WRITE_AFTER_FREE_CHECK) {
if (!WRITE_AFTER_FREE_CHECK || !ro.zero_on_free) {
return;
}
@ -610,7 +611,7 @@ static inline void deallocate_small(void *p, const size_t *expected_size) {
}
}
if (ZERO_ON_FREE) {
if (ro.zero_on_free) {
memset(p, 0, size - canary_size);
}
}
@ -940,6 +941,17 @@ static inline void enforce_init(void) {
}
}
COLD static void handle_camera_bug(void) {
const char expected[] = "/vendor/bin/hw/android.hardware.camera.provider@2.4-service_64";
char path[sizeof(expected)];
if (readlink("/proc/self/exe", path, sizeof(path)) == -1) {
return;
}
if (strcmp(expected, path) == 0) {
ro.zero_on_free = false;
}
}
COLD static void init_slow_path(void) {
static struct mutex lock = MUTEX_INITIALIZER;
@ -954,6 +966,9 @@ COLD static void init_slow_path(void) {
ro.metadata_pkey = pkey_alloc(0, 0);
#endif
ro.zero_on_free = ZERO_ON_FREE;
handle_camera_bug();
if (sysconf(_SC_PAGESIZE) != PAGE_SIZE) {
fatal_error("page size mismatch");
}
@ -1127,7 +1142,7 @@ EXPORT void *h_calloc(size_t nmemb, size_t size) {
total_size = adjust_size_for_canaries(total_size);
void *p = allocate(total_size);
thread_seal_metadata();
if (!ZERO_ON_FREE && likely(p != NULL) && total_size && total_size <= max_slab_size_class) {
if (!ro.zero_on_free && likely(p != NULL) && total_size && total_size <= max_slab_size_class) {
memset(p, 0, total_size - canary_size);
}
return p;